@webpresso/plugin-opencode 0.0.12 → 0.0.14

package/bin/wp

@@ -0,0 +1,250 @@
+#!/bin/sh
+# webpresso-wp-shim v1 — keep this marker on line 2 (shim loop guard).
+#
+# The one `wp` shim. Copied byte-identically into each plugin's bin/wp
+# (packages/scripts/stage-plugin-runtime-artifacts.ts) and, once the release
+# installer adopts it, into ~/.webpresso/bin/wp. It stores no state, writes
+# nothing, and picks the runtime on EVERY call from where it is called:
+#
+#   1. WEBPRESSO_WP_BIN (an absolute executable)  xor  WP_FORCE_JIT_PATH (an
+#      absolute checkout)
+#   2. the nearest ancestor of $PWD that is a webpresso source checkout
+#      (bin/wp + src/cli/cli.ts) ADMITTED in ~/.webpresso/source-checkouts
+#      -> <checkout>/bin/wp, whose own launcher guards freshness against HEAD.
+#      Layout is not trust: a source-shaped directory whose repository is not
+#      listed there fails with checkout-not-admitted instead of running its
+#      bin/wp. A linked worktree is admitted through its repository, and only
+#      when the admitted repository's own .git/worktrees/*/gitdir names it.
+#   3. else (no checkout ancestor at all) the nearest ancestor
+#      .webpressorc.json: its top-level exact-semver "runtime" pin
+#      -> ~/.webpresso/runtimes/<pin>/wp (missing = error)
+#   4. else the newest stable ~/.webpresso/runtimes/<x.y.z>/wp
+#   5. else a named error, exit 127 — never a different runtime. A pre-shim
+#      ~/.webpresso/bin/wp is never run implicitly (nothing in it proves it is
+#      a release rather than a development build); name it with
+#      WEBPRESSO_WP_BIN.
+#
+# Bounded: a parent-directory walk, one-line reads of the user's admission file
+# and of admitted repositories' worktree back-links, at most one size-capped
+# JSON read (node, only in a consumer repo with a
+# .webpressorc.json), one directory listing. No git, no network, no retries,
+# no timeouts. Mode and error literals
+# are the closed vocabulary in src/runtime/runtime-selector-vocab.ts.
+#
+# `exec`, not a spawn wrapper: the MCP server this launches is a long-lived
+# stdio service, and a relay process could die and orphan it. Arguments are
+# forwarded verbatim through "$@".
+
+set -u
+
+announced_modes='explicit-binary explicit-checkout'
+
+fail() {
+  printf 'wp-shim: error %s: %s\n' "$1" "$2" >&2
+  exit 127
+}
+
+MODE=
+TARGET=
+choose() {
+  MODE=$1
+  TARGET=$2
+}
+
+admission_file=${HOME:-}/.webpresso/source-checkouts
+
+is_source_shaped() {
+  [ -f "$1/bin/wp" ] && [ -x "$1/bin/wp" ] && [ -f "$1/src/cli/cli.ts" ]
+}
+
+# True when checkout $1 is an admitted repository's primary checkout, or one of
+# its registered linked worktrees. The admission file is user-owned, one
+# absolute primary-checkout path per line. Identity is by directory (-ef), and
+# a linked worktree is recognized only from the admitted repository's own
+# .git/worktrees/*/gitdir back-links: nothing inside the project (its .git
+# file, symlink or metadata) is ever read or trusted, and stat never blocks.
+is_admitted_checkout() {
+  [ -f "$admission_file" ] || return 1
+  while IFS= read -r entry || [ -n "$entry" ]; do
+    case $entry in /*) ;; *) continue ;; esac
+    [ "$entry" -ef "$1" ] && return 0
+    for meta in "$entry"/.git/worktrees/*/; do
+      [ -f "${meta}gitdir" ] || continue
+      back=
+      IFS= read -r back <"${meta}gitdir" || [ -n "$back" ] || continue
+      [ "${back%/.git}" -ef "$1" ] && return 0
+    done
+  done <"$admission_file"
+  return 1
+}
+
+# Exact semver x.y.z[-pre], no leading zeros, no build metadata. With a second
+# argument "stable", a prerelease is rejected too.
+is_exact_semver() {
+  version=$1
+  core=${version%%-*}
+  pre=
+  if [ "$core" != "$version" ]; then
+    pre=${version#*-}
+    [ "${2:-}" != stable ] || return 1
+    case $pre in '' | .* | *. | *..* | *[!0-9A-Za-z.-]*) return 1 ;; esac
+    saved_ifs=$IFS
+    IFS=.
+    # shellcheck disable=SC2086 # deliberate field split on "."
+    set -- $pre
+    IFS=$saved_ifs
+    for part in "$@"; do
+      case $part in 0?*) case $part in *[!0-9]*) ;; *) return 1 ;; esac ;; esac
+    done
+  fi
+  case $core in '' | .* | *. | *..* | *[!0-9.]*) return 1 ;; esac
+  saved_ifs=$IFS
+  IFS=.
+  # shellcheck disable=SC2086 # deliberate field split on "."
+  set -- $core
+  IFS=$saved_ifs
+  [ "$#" -eq 3 ] || return 1
+  for part in "$@"; do
+    case $part in '' | 0?* | *[!0-9]*) return 1 ;; esac
+  done
+  return 0
+}
+
+runtimes_dir=${HOME:-}/.webpresso/runtimes
+
+# Sets PIN to the top-level "runtime" of $1 (empty when absent). The document
+# is opened non-blocking, must be a regular file, and is read through a
+# 64 KiB + 1 buffer on that one descriptor (growth after open cannot exceed
+# it); anything longer is refused. The pin
+# is validated as an exact semver BEFORE it crosses back into the shell, so no
+# shell transport (such as a stripped trailing newline) can change it.
+read_pin() {
+  PIN=$(node -e '
+    const fs = require("node:fs");
+    let fd;
+    try { fd = fs.openSync(process.argv[1], fs.constants.O_RDONLY | fs.constants.O_NONBLOCK); } catch { process.exit(2); }
+    if (!fs.fstatSync(fd).isFile()) process.exit(3);
+    const limit = 65536;
+    const buffer = Buffer.alloc(limit + 1);
+    let length = 0;
+    for (let n; length <= limit && (n = fs.readSync(fd, buffer, length, limit + 1 - length, null)) > 0; ) length += n;
+    if (length > limit) process.exit(3);
+    let v;
+    try { v = JSON.parse(buffer.subarray(0, length).toString("utf8")); } catch { process.exit(2); }
+    if (v === null || typeof v !== "object" || Array.isArray(v) || !Object.hasOwn(v, "runtime")) process.exit(0);
+    const pattern = /^(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)(?:-(?:0|[1-9]\d*|\d*[A-Za-z-][0-9A-Za-z-]*)(?:\.(?:0|[1-9]\d*|\d*[A-Za-z-][0-9A-Za-z-]*))*)?$/u;
+    if (typeof v.runtime !== "string" || !pattern.test(v.runtime)) process.exit(4);
+    process.stdout.write(v.runtime);
+  ' "$1" 2>/dev/null)
+  case $? in
+    0) return 0 ;;
+    3) PIN_PROBLEM="is not a regular file of at most 64 KiB" ;;
+    4) PIN_PROBLEM="has a \"runtime\" pin that is not an exact version such as 1.2.3 (no ranges, no build metadata)" ;;
+    127) PIN_PROBLEM="cannot be read: node is not on PATH" ;;
+    *) PIN_PROBLEM="is not valid JSON" ;;
+  esac
+  return 1
+}
+
+choose_latest_release() {
+  best=
+  best_major=
+  best_minor=
+  best_patch=
+  for entry in "$runtimes_dir"/*/; do
+    [ -d "$entry" ] || continue
+    entry=${entry%/}
+    version=${entry##*/}
+    is_exact_semver "$version" stable || continue
+    [ -f "$entry/wp" ] && [ -x "$entry/wp" ] || continue
+    major=${version%%.*}
+    rest=${version#*.}
+    minor=${rest%%.*}
+    patch=${rest#*.}
+    if [ -z "$best" ] ||
+      [ "$major" -gt "$best_major" ] ||
+      { [ "$major" -eq "$best_major" ] && [ "$minor" -gt "$best_minor" ]; } ||
+      { [ "$major" -eq "$best_major" ] && [ "$minor" -eq "$best_minor" ] && [ "$patch" -gt "$best_patch" ]; }; then
+      best=$version
+      best_major=$major
+      best_minor=$minor
+      best_patch=$patch
+    fi
+  done
+  if [ -n "$best" ]; then
+    choose latest-release "$runtimes_dir/$best/wp"
+    return 0
+  fi
+  return 1
+}
+
+is_shim_file() {
+  [ -f "$1" ] || return 1
+  { head -c 256 "$1" | grep -q 'webpresso-wp-shim'; } 2>/dev/null
+}
+
+choose_release() {
+  if [ -n "${1:-}" ]; then
+    rc_file=$1/.webpressorc.json
+    read_pin "$rc_file" || fail pin-invalid "$rc_file $PIN_PROBLEM."
+    if [ -n "$PIN" ]; then
+      is_exact_semver "$PIN" || fail pin-invalid "$rc_file pins runtime \"$PIN\"; use an exact version such as 1.2.3 (no ranges)."
+      pinned=$runtimes_dir/$PIN/wp
+      [ -f "$pinned" ] && [ -x "$pinned" ] || fail pin-not-installed "$rc_file pins runtime $PIN, but $pinned is not installed under $runtimes_dir."
+      choose pinned-release "$pinned"
+      return 0
+    fi
+  fi
+  choose_latest_release && return 0
+  fail no-release-installed "no webpresso source checkout above $PWD and no release under $runtimes_dir; install the Webpresso app, or name a runtime explicitly with WEBPRESSO_WP_BIN (for example a pre-shim \$HOME/.webpresso/bin/wp release) or WP_FORCE_JIT_PATH (a source checkout)."
+}
+
+: "${WEBPRESSO_WP_BIN:=}"
+: "${WP_FORCE_JIT_PATH:=}"
+
+if [ -n "$WEBPRESSO_WP_BIN" ] && [ -n "$WP_FORCE_JIT_PATH" ]; then
+  fail both-overrides-set "WEBPRESSO_WP_BIN and WP_FORCE_JIT_PATH are both set; unset one."
+elif [ -n "$WEBPRESSO_WP_BIN" ]; then
+  case $WEBPRESSO_WP_BIN in /*) ;; *) fail override-missing "WEBPRESSO_WP_BIN must be an absolute path (got $WEBPRESSO_WP_BIN); exec would otherwise search PATH for a different file." ;; esac
+  [ -f "$WEBPRESSO_WP_BIN" ] && [ -x "$WEBPRESSO_WP_BIN" ] || fail override-missing "WEBPRESSO_WP_BIN points to $WEBPRESSO_WP_BIN, which is not an executable file."
+  choose explicit-binary "$WEBPRESSO_WP_BIN"
+elif [ -n "$WP_FORCE_JIT_PATH" ]; then
+  case $WP_FORCE_JIT_PATH in /*) ;; *) fail override-missing "WP_FORCE_JIT_PATH must be an absolute path (got $WP_FORCE_JIT_PATH)." ;; esac
+  is_source_shaped "$WP_FORCE_JIT_PATH" || fail override-missing "WP_FORCE_JIT_PATH points to $WP_FORCE_JIT_PATH, which is not a webpresso source checkout (executable bin/wp and src/cli/cli.ts)."
+  choose explicit-checkout "$WP_FORCE_JIT_PATH/bin/wp"
+else
+  # Checkout first, across every ancestor: a .webpressorc.json nested inside
+  # a source checkout must not pin a foreign runtime there. Only when no
+  # ancestor is a checkout does the nearest consumer config decide.
+  dir=${PWD:-}
+  consumer_root=
+  while [ -n "$dir" ]; do
+    if is_source_shaped "$dir"; then
+      is_admitted_checkout "$dir" || fail checkout-not-admitted "$dir looks like a webpresso source checkout, but its repository is not listed in $admission_file; add the absolute path of its primary checkout there (one per line) to run its bin/wp, or set WP_FORCE_JIT_PATH=$dir for this call."
+      choose checkout "$dir/bin/wp"
+      break
+    fi
+    if [ -z "$consumer_root" ] && [ -e "$dir/.webpressorc.json" ]; then
+      consumer_root=$dir
+    fi
+    [ "$dir" != / ] || break
+    dir=${dir%/*}
+    [ -n "$dir" ] || dir=/
+  done
+  [ -n "$TARGET" ] || choose_release "$consumer_root"
+fi
+
+# Never exec a shim: this one (directly or through a symlink) or another
+# byte-identical plugin copy would recurse instead of reaching a runtime.
+if [ "$TARGET" = "$0" ] || [ "$TARGET" -ef "$0" ] || is_shim_file "$TARGET"; then
+  fail self-reference "$MODE resolved to a wp shim ($TARGET); point it at a wp runtime instead."
+fi
+
+case " $announced_modes " in
+  *" $MODE "*) printf 'wp-shim: %s %s\n' "$MODE" "$TARGET" >&2 ;;
+esac
+
+WP_SKIP_UPDATE_CHECK=${WP_SKIP_UPDATE_CHECK:-1}
+export WP_SKIP_UPDATE_CHECK
+
+exec "$TARGET" "$@"